Issues

• [Tracking] Push notification follow-ups after #417

  enhancementMobile
  Task

  docs-plus/docs.plus#447 · Filter by author HMarzban opened on Oct 6, 2026

• Remove dead code left after the security fixes

  Refactor
  Task

  docs-plus/docs.plus#446 · Filter by author HMarzban opened on Oct 6, 2026

• Unsubscribe only when the reader confirms, not when a link scanner opens the email link

  bug
  Bug

  docs-plus/docs.plus#445 · Filter by author HMarzban opened on Oct 6, 2026

• Clear chat drafts and stale document keys on sign-out

  AuthbugChatSecurity
  Bug

  docs-plus/docs.plus#444 · Filter by author HMarzban opened on Oct 6, 2026

• Give the observability containers least privilege

  DevOpsSecurity
  Task

  docs-plus/docs.plus#443 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Use a cryptographic random source for new document slugs

  bugSecurity
  Bug

  docs-plus/docs.plus#442 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Confirm the password-token hook is on, and correct the connected-app docs

  AuthSecurity
  Task

  docs-plus/docs.plus#441 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Require approval before fork pull requests run workflows

  CriticalDevOpsSecurity
  Task

  docs-plus/docs.plus#440 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Serve editor media of a Private document only to its owner

  bugEditorSecurity
  Bug

  docs-plus/docs.plus#439 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Require a password on production Redis

  DevOpsSecurity
  Task

  docs-plus/docs.plus#438 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Run only reviewed main-branch workflows on the production runner

  DevOpsSecurity
  Task

  docs-plus/docs.plus#437 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• A pasted node or a channel row can crash a document page for every reader

  bugChatEditorSecurity
  Bug

  docs-plus/docs.plus#436 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Clear the text of a chat message when it is deleted

  bugChatSecurity
  Bug

  docs-plus/docs.plus#435 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Stop exposing every user's online status and last-active time

  bugProfileSecurity
  Bug

  docs-plus/docs.plus#434 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Move the email and push gateway reports behind admin auth

  AuthbugSecurity
  Bug

  docs-plus/docs.plus#433 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Let non-members read only chat media that a live message uses

  bugChatSecurity
  Bug

  docs-plus/docs.plus#432 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Stop the public avatar buckets from accepting SVG files

  bugProfileSecurity
  Bug

  docs-plus/docs.plus#431 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Re-check a WebSocket's identity when its access token expires

  AuthbugSecurity
  Bug

  docs-plus/docs.plus#430 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Keep the access token out of document page props

  AuthbugOffline-ModeSecurity
  Bug

  docs-plus/docs.plus#429 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• A forged presence payload can change the avatar on live chat messages

  bugChatSecurity
  Bug

  docs-plus/docs.plus#428 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Clear the public profile when an account is soft-deleted

  bugProfileSecurity
  Bug

  docs-plus/docs.plus#427 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Check that a document id is one path segment before local media is deleted

  bugEditorSecurity
  Bug

  docs-plus/docs.plus#426 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06

• Email 7/7 (Ops B): Supabase Auth magic links through Resend SMTP

  enhancement
  Task

  docs-plus/docs.plus#425 · Filter by author HMarzban opened on Oct 6, 2026
  

• Email 6/7 (Ops A): production product mail cutover to Resend

  enhancement
  Task

  docs-plus/docs.plus#424 · Filter by author HMarzban opened on Oct 6, 2026
  

• Email 5/7 (PR 4): admin Email setup page with a test email

  enhancement
  Task

  docs-plus/docs.plus#423 · Filter by author HMarzban opened on Oct 6, 2026